While dynamic systems for detecting security vulnerabilities in mobile or web applications often report low runtime overhead, the dynamic systems for fixing security vulnerabilities typically incur more significant overhead. This difference in overhead exists because a computing system needs to track a considerable amount of contextual data in order to correctly repair a security vulnerability. For example, to correctly fix privacy vulnerabilities in mobile applications using a precise information tracking approach, the computing system must keep track of primitive values, and the system must also implement a computationally expensive, source-sensitive, character-level taint analysis procedure. Taint analysis is a form of information flow analysis. Information flows from object x to object y whenever information stored in object x is transferred to object y. If the source of the value of the object x is untrustworthy, then object x is regarded as tainted. The additional overhead required to keep track of primitive values and perform taint analysis typically represents an increase of several times to several hundred times, rendering such dynamic approaches infeasible to put into practice.
An alternative approach to information tracking, which is more efficient but less precise, is value-based information tracking. In value-based information tracking, the computing system remembers the values that are observed at a data source, and then checks to ascertain whether these values are observed at a data sink. The data sink is an object that can be bound to external data made available by the data source. One limitation of the value-based tracking approach is that if an application modifies a sensitive value, then the computing system may miss a security vulnerability. Thus, there exists a need to overcome at least one of the preceding deficiencies and limitations of the related art.